ESI Search Warrants

The Federal Rule of Criminal Procedure, Rule 41(e)(2)(A) authorizes the seizure of ESI or media containing ESI. Prominent e-Discovery Judges John M. Facciola and David Waxse have issued decisions denying such warrants.

Judge Facciola's decision in In the Matter of the Search of Information Associated with [Redacted]@mac.com That is Stored at Premises Controlled by Apple, Inc., 25 F. Supp. 3d 1 (D.D.C. 2014) recommended that government ask a service provider to obtain limited information; appoint a special master to hire a vendor who can perform searches; delegate the search to a personnel that will not disclose other information to investigators, or even have a magistrate judge waive the plain view doctrine.

Electronic Discovery and Digital Evidence in a Nutshell - Chapter XII Outline

Here's the last installment of my outline of Electronic Discovery and Digital Evidence in a Nutshell, the second edition of the West Academic guide to electronic discovery law in the United States authored by Judge Shira Scheindlin (the judge in the Zubulake v. UBS Warburg) and members of the Sedona Conference. The previous installment was posted on April 10, 2017.

XII. ADMISSIBILITY OF DIGITAL EVIDENCE

1. INTRODUCTION

2. FRCP 101(b)(6) – digital evidence is admissible whenever hardcopy evidence of the same type would be admissible.

3. HOW IS DIGITAL EVIDENCE USED IN COURT?

4. Electronic Business Records

5. Computer generated animation – e.g. how an accident occurred.

6. Digital presentation to illustrate an expert’s opinion.

7. Pedagogic device – aid in questioning a witness

8. Digital Enhancement –

9. Information from the internet –

10. Emails

11. Other: GPS data; metadata from Word documents.

12. WHICH EVIDENTIARY RULES ARE MOST OFTEN INVOKED WHEN DIGITAL EVIDENCE IN PREOFFERED?

13. Five basic concepts raised by digital evidence

14. Relevance and Prejudice – Rule 403 – probative value outweighed by danger of prejudice, confusion of issues, misleading the jury, undue delay, waste of time, needless presentation of cumulative evidence.

15. Authenticity – Rule 901- means to establish

16. Testimony

17. Appearance taken in conjunction with the circumstances.

18. Evidence describing a process used to produce an accurate result.

19. Hearsay - out of court statement offered to prove the truth of the matter asserted.

20. Rule 801 exemptions – admissions and prior statements.

21. Rule 803, 804, and 807 exceptions. – business and public records.

22. Best Evidence Rule – to prove contents of writing proponent must introduce the original or acceptable duplicate – Rules 1001-1004.

23. Duplicate can be challenged if genuine issue as to authenticity or use is somehow unfair.

24. Can forgo if good reason for not having it.

25. United States v. Bennett (9th Cir. 2004) – testimony by Coast Guard officer of GPS backtrack info not admissible when device was not seized. No evidence presented that it would have been difficult to download GPS data.

26. Requirements for Admissible Expert Testimony - Rule 702 –

27. Testimony based on sufficient facts or data

28. Product of reliable principles and methods

29. Witness has applied principle and methods reliably to the facts of the case.

30. GENERAL APPROACH TO DIGITAL EVIDENCE

31. Digital evidence, like all evidence must be probative, reliable and authentic.

1. ADMISSIBILITY REQUIREMENTS FOR COMMON TYPES OF DIGITAL EVIDENCE

2. Business and Public Records

3. US v. Hassan (4th Cir. 2014) – screenshots of Facebook and YouTube with certificates had been maintained as business records in the regular course of business.

4. Machine Generated Evidence

5. Computer generated evidence is not hearsay.

6. Digital Demonstrative Evidence

7. Rule 403 applied to determine if reconstruction is substantially similar.

8. Bowoto v. Chevron – 3D model of accident not allowed under Rule 403 if not as accurate as possible.

9. Digital Presentation to Illustrate Expert’s Opinion or Party’s Theory of a Case

10. People v. Duenas (Cal. 2012) – computer animation showing party’s theory of how shooting occurred can be admitted if limiting instruction given to the jury.

11. Pedagogical Devices

12. Argument should be confined to facts introduced in evidence, facts of common knowledge and logical inferences.

13. Summary of Voluminous Evidence

14. Evaluate under Rule 1006.

15. Digital Enhancements

16. U.S. v. Seifert (8th Cir. 2006) – digitally enhance surveillance tape admissible – expert real timed a time lapse video, zoomed in, and brightened it.

17. Internet Evidence

18. Web site data

19. Data posted by others with owner’s consent (e.g. chat room)

20. Data posted without consent (hacking material)

21. Authentication of Internet Evidence

22. Web sites

23. Rule 901(a) – What was on the web site? Does the exhibit accurately reflect it? Is the exhibit attributable to the owner?

24. Court will review the totality of the circumstances –

25. Length of time data was on the site.

26. Data published elsewhere

27. Distinctive design.

28. Self-Authentication

29. Internal publication of a government document constitutes official publication by Rule 902(5).

30. Rule 902(6) online newspapers and periodicals are self-authenticating.

31. Courts may take judicial notice of government sites, or map sites.

32. Internet Archives –

33. Temporary internet files – expert testimony about retrieval process sufficient to authenticate.

34. Search engines – testimony or certification as to results is required.

35. Hearsay Issues with Respect to Internet Evidence\

36. Every extrajudicial statement drawn from a web site has been made out of court and must satisfy exception or exemption

37. Data Entry – hearsay – act of data entry considered separate from content of posted declaration.

38. Only assertive non-verbal conduct raises hearsay issues – e.g. punching price into checkout computer – assertive; scanning bar code non-assertive.

39. Business and Public Records on a Web Site – hearsay exception under Rule 803.

40. Market Reports and Tables – Rule 803 exception

41. Admissions – published website data by litigation is a hearsay exemption.

42. Non-hearsay proffers – No hearsay issues if offered to show only that the data was published on the web, e.g. in punitive damages proceeding.

43. Email Evidence

44. Authentication of Email – low standard. Rule 901(b) can authenticate by its appearance and contents.

45. US v. Siddiqui (11th Cir. 2000) and US v . Fluker (7th Cir. 2012) – email authentication by circumstantial evidence.

46. Domain in email address is a mark of origin under Rule 902(7) that can be used to authenticate.

47. Circumstantial indicia include replies to email; address consistent with that on other emails; email contained full name of recipient; recited matters know only to sender or recipient.

48. Authenticity of text messages are a question of fact for the jury as long as there is circumstantial evidence of source.

49. Hearsay issues – don’t fall under business records exception.

50. Email may contain hearsay with hearsay –

51. Admission by Party Opponent – email from opponent not excluded by hearsay rule.

52. Social Media and Chat Room Evidence

53. US v. Gatson (D.N.J. 2014) – no search warrant required for use of undercover account on social media

54. Social media content can be authenticated by testimony of creator, someone who saw an item be posted; expert testimony concerns results of a search, or methods of access.

55. People v. Valdez (Cal. 2011) – government had sufficiently authenticated postings from MySpace by showing use of password and user name and nature of content – despite defendant position that he was hacked.

Electronic Discovery and Digital Evidence in a Nutshell - Chapter XI Outline

Here's another installment of my outline of Electronic Discovery and Digital Evidence in a Nutshell, the second edition of the West Academic guide to electronic discovery law in the United States authored by Judge Shira Scheindlin (the judge in the Zubulake v. UBS Warburg) and members of the Sedona Conference. An outline of the previous chapter was posted on March 20, 2017.

XI. PRIVILEGE ISSUES ARISING DURING ELECTRONIC DISOCVERY

A. RISKS OF WAIVER AND THE COST OF PRE-PRODUCTION PRIVLEGE REVIEW OF ELECTRONIC DATA a. Mohawk Indus. v. Carpenter (U.S. 2009) adverse ruling in the privilege question is not immediately appealable. b. FRE 502 adopted in September 2008 i. Mistaken disclosure never constitutes subject matter waiver. ii. No waiver if party took reasonable steps to prevent disclosure and rectified once discovered. 1. Review process more likely to be reasonable if only a small portion disclosed. 2. Was there an accelerated deadline? 3. Were search terms reasonable? 4. Efficient records management system before litigation arises. 5. Levels of review and amount of eyes-on review. iii. Coburn Group v. Whitecap Advisors (N.D. Ill. 2009) – 1. Use of paralegals closely supervised by a lawyer was not unreasonable. 2. Not unreasonable to forgo post-production review. iv. FRE 502(c) privileged docs disclosed in state proceeding then admissibility in federal proceeding determined by law that is most protective against waiver. v. FRE 502(d) – if fed. ct. orders that disclosure of privileged communications is not waiver then order enforceable against all parties in any state or federal proceeding. vi. Rajala v. McGuire Woods, (D. Kan. 2010) 1. Court can issue 502(d) order sua sponte. 2. Good cause if volume of production high, risk of inadvertent disclosure great, and order would expedite the e-discovery process. vii. 502(d) order only extends to proceeding in which it is entered. viii. 502 (e ) parties can enter into a confidentiality agreement that provides protection against waiver.

B. AGREEMENTS BETWEEN THE PARTIES TO CONTROL THE COST OF PRE-PRODUCTION PRIVILEGE REVIEW OF ELECTRONIC DATA. a. Quick peek agreements – requested materials provided for initial examination without any privilege. Requesting party designates the documents it wants produced. b. Clawback agreement – no waiver if producing party identifies the documents; they must be returned. c. Clawback and quick peek agreements do not bind non-parties absent a 502(d) order.

C. WHAT PRECAUTIONS SHOLD BE EMPLOYED? a. Victor Stanley v. Creative Pipe (D. Md. 2008) – party requesting inadvertently produced documents has the burden of showing its review was reasonable. Burden not met because: i. No information on keywords used. ii. No Rationale for keyword selection. iii. No qualification to design information retrieval method. iv. No analysis to test reliability of results. b. in some states— Texas for example— there is no risk of inadvertent waiver, because those states hold that any waiver of privilege must be intentional.

D. ETHICAL QUESTIONS INVOLVED IN RECEIVING MISTAKENLY DISCLOSED PRIVILEGE INFORMATION a. FRCP 26(b)(5)(B) – if no confidentiality agreement, if receiving party is notified of mistaken disclosure by adversary it must promptly return or destroy the data. Party can ask a court if the data is protected. b. If it would be cost prohibitive for the receiving party to retrieve the information court may find that privilege was waived. c. Rule 26 does not require the receiving party to tell the producing party that privileged information was disclosed, but ABA Model Rule 4.4 says receiving party must notify the producing party of the mistake.